Splunk Enterprise

Data is not rolling out from warm to Cold bucket


Hi All, I have created one index in test environment as like below. 


homePath = $SPLUNK_DB/f5/db
coldPath = $SPLUNK_DB/f5/colddb
thawedPath = $SPLUNK_DB/f5/thaweddb
enableDataIntegrityControl = 0
#enableTsidxReduction = 0
maxTotalDataSizeMB = 180000

I don't see any bucket in coldDB path . But the bucket count in WARM is above 300. Why this data is not rolling out to cold and also to frozen. I am having the data greater than(around 200GB)  maxTotalDataSizeMB.

splunk@hostname: # ls -lrt
total 72
drwx------ 2 splunk splunk 4096 Mar 12 2020 thaweddb
drwx------ 2 splunk splunk 4096 Jun 10 09:42 colddb
drwx------ 2 splunk splunk 4096 Jun 10 09:43 summary
drwx------ 3 splunk splunk 4096 Jun 10 09:43 datamodel_summary
drwx------ 283 splunk splunk 53248 Jun 10 10:51 db
splunk@hostname: # cd colddb
splunk@hostname: # ls -lrt
total 0
splunk@hostname: # pwd

What is best practice i can do for rolling out in indexes.conf . Am i missing something ? Please let me know if you have any questions. Thank you

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...